The chaos and confusion that accompany war and natural disasters can separate families when they need each other most. The Canadian Red Cross Restoring Family Links program helps people in Canada re-establish contact with immediate family members after separation due to armed conflict, natural disaster, migration and other humanitarian crisis.
Whether the separation from your loved one happened many decades ago or more recently, the Canadian Red Cross may be able to help. The process involves collecting information about persons who are missing, persons who have died, and vulnerable persons such as children separated from their families and persons deprived of their freedom.
Search requests are accepted based on:
- the closeness of the relationship
- the reason for loss of contact
- sufficient information being available to conduct a search
- attempts already made by the inquirer to locate the sought person have been unsuccessful.
- (a) When a loved one is missing
If you are looking for a family member overseas and would like us to help, please contact us:
By email: familylinks@redcross.ca
Online: Fill out this form
By Phone:
Open Letter to Clients of Restoring Family Links
Last Updated: July 7, 2023
The Canadian Red Cross has been notified by the International Committee of the Red Cross (ICRC) of a cyber security incident relating to the Red Cross Movement’s Restoring Family Links (RFL) program and its related services. The systems that support these services are operated by the ICRC and used by Red Cross and Red Crescent National Societies globally, including the Canadian Red Cross. The Canadian Red Cross is a separate organization from the ICRC, but uses an ICRC server for the RFL program.
As a result of the incident, the Canadian Red Cross temporarily suspended some of its RFL services, which were subsequently all restored on May 19, 2022.
We wish to inform individuals who have used or benefited from the RFL program and its related services that personal information provided to the Canadian Red Cross in connection with such services may have been affected by this incident.
What happened?
The circumstances of the incident were investigated by the ICRC. As of the date of this notice, the ICRC believes that a targeted attack was carried out on ICRC servers. This means that an unauthorized third party accessed the RFL system and may have accessed the personal information of individuals who have used or benefited from the RFL program and its related services.
The ICRC has no immediate indications as to who carried out this attack or if the perpetrator had any particular intention. That said, there is currently no indication that personal information stored in the RFL system has been tampered with, lost, deleted, misused, published, or traded. This situation is being closely monitored by the ICRC.
When did the incident occur?
The ICRC has determined that the affected systems and digital tools were first accessed by the perpetrator on November 9, 2021. The ICRC and its cybersecurity contractors discovered the incident and began remediation efforts on January 18, 2022.
What personal information was involved?
Based on the information provided to date, the incident affected RFL case records, which may contain the personal information of an enquirer, a missing/separated person (Sought Person), unaccompanied family members, an individual who is or has been detained outside of Canada (Detainee), the recipients of Detainees’ messages, and/or individuals appointed to speak on behalf of an enquirer. Depending on the nature of each case, such information may include:
- Each individual’s full name and/or contact details (including last known address, mailing address, email address and/or phone number);
- Unique ICRC number assigned to an individual detained;
- Any personal information contained in the narrative provided to the CRC about the circumstances related to the enquirer’s or beneficiary’s request;
- Copies of a Sought Person’s, or former Detainee’s identification, foreign passport submissions and/or photograph;
- A Sought Person’s, unaccompanied family member, or Detainee’s date of birth;
- The dates, locations and circumstances of a Detainee’s arrest/capture, detention, visit by the ICRC, release, repatriation, and/or death;
- A Detainee’s nationality and mother’s maiden name;
- Any personal/family information contained in any communications between a Detainee and their family that are facilitated by the Canadian Red Cross and/or ICRC; and/or
- Any personal health information contained within a Sought Person’s file, for example if the person was last seen at a hospital or has a disclosed disability.
It is important to note this information within the ICRC system varies for each individual and it includes only the documents you have provided to the Red Cross in the course of managing your case. We do not collect or store any other information that you have not provided to us.
The Red Cross also facilitates the forwarding of certain records, such as school records and birth certificates, to individuals in conflict areas. The affected RFL case records may have contained information about the senders and recipients of such documents, including an individual’s full name or contact information, as well as the records themselves.
In rare cases, the Canadian Red Cross processes returns of the ICRC Emergency Travel Documents to the ICRC Headquarters in Geneva, Switzerland. The affected RFL case records may have contained information about a small number of requestors of such service, including an individual’s full name and contact information, photograph, travel itinerary, travel visa information, and/or a copy of the individual’s fingerprint.
The incident also affected the login information of a small number of Red Cross and Red Crescent staff and volunteers, including their Canadian Red Cross email address and Canadian Red Cross phone number, and their correspondence and case notes regarding RFL services.
What has been done to respond to the incident?
When the ICRC became aware of the incident, it promptly suspended all access to the compromised systems and took the compromised servers offline. The Canadian Red Cross understands that the ICRC has also reported the incident to law enforcement in Switzerland.
Before the incident, the ICRC had invested substantially in cyber security, implemented systems to help detect suspicious activity (which is how the ICRC detected this attack), and contracted an external company to conduct annual audits of its system. In light of this incident, the ICRC has advised us that it will invest into additional resources to combat highly sophisticated cyber operations.
ICRC hired an independent audit firm to confirm the integrity of the affected information. The ICRC reviewed each affected application log to better understand how the incident occurred and also appointed a dedicated team to follow any reports of affected information being made available online. Further updates on ICRC’s activities related to this incident are available on the ICRC’s website
here. Please note that the Canadian Red Cross is not responsible for, and has not independently verified, the contents of the ICRC’s updates.
Internally, the Canadian Red Cross has assessed the impact this incident has had on the individuals it supports. An independent review of local systems and services was completed to ensure that they remain secure. All Canadian Red Cross staff with access to the RFL system were instructed to and have changed their login credentials.
What precautionary steps can you take to protect yourself and your personal information?
All individuals who have used or benefited from the RFL program and its related services are encouraged to inform about this incident any family members or other individuals whose personal information was provided to the Canadian Red Cross or ICRC.
Affected individuals are also advised to:
- Beware of phishing attacks, which is the practice of sending fraudulent communications that appear to come from a reputable source.
- Immediately delete, hang up, and do not forward or otherwise share any suspicious emails, phone calls or text messages asking for your personal information, or claiming to be from Red Cross.
- Do not respond to suspicious messages or provide any personal details to unsolicited emails, phone calls or text messages that you may receive. Whenever in doubt, please contact the Canadian Red Cross via the contact details below before taking action regarding any messages.
- Monitor your mail for any disruption in delivery. If you notice any irregularities, report them to Canada Post or to your local mail service.
- Request a free copy of your credit report from one of Canada’s two national credit bureaus, and repeat this process periodically. Review the reports for any information that is inaccurate and for accounts or creditor inquiries that you did not initiate or do not recognize. If you see anything that you do not understand, call the credit reporting agency. Canada’s national credit bureaus can be contacted as follows:
- Consider arranging for one of these credit bureaus to place an alert on your credit file, which generally encourages creditors to take additional steps to validate your identity prior to opening a new account under your name.
- Contact the Canada Revenue Agency (CRA) and ask to put a password on your account or to disable online access to your account. You can reach the CRA Individual Tax Inquiries Line at 1-800-959-8281.
- If you detect any suspicious or fraudulent activity, promptly notify (i) your financial institution or organization with which your account is maintained; (ii) local law enforcement; (iii) the Canadian Anti-Fraud Centre; and (iv) the Canadian Red Cross, at the contact information listed below.
Where can you obtain additional information?
The Canadian Red Cross’s Privacy Officer is available to answer questions related to this incident. Questions can be sent by email to
privacy@redcross.ca. If you are having difficulty accessing online services, please write to the Privacy Officer at:
Privacy Officer
Canadian Red Cross Society
400 Cooper Street, Suite 8000
Ottawa, Ontario
K2P 2H8
Canada
You may also periodically review the ICRC’s online
Q&A document, which is continuously updated by the ICRC with new information and developments regarding the incident as they become available. Please note that the Canadian Red Cross is not responsible for, and has not independently verified, the contents of the ICRC’s Q&A document.
The Canadian Red Cross’s message to you
We sincerely regret that this incident has occurred. The Canadian Red Cross is committed to continuing our efforts to protect the personal information of our beneficiaries. We are working hard to restore the services that the Red Cross Red Crescent Movement is so proud to offer across the world and to continue to serve you.
Sincerely,
The Canadian Red Cross